Real Estate Section 4 Compliance: Notice Requirements for Property Listings & Deals

Applies to	Real Estate agents, property portals, brokers & developers operating in India
Primary law	DPDPA 2023 · Section 4
Penalty ceiling	₹150 crore per violation
Enforcement status	Data Protection Board accepting complaints — 2026-07
Source	DPDPAReady Compliance Team

Real Estate Section 4: When Notice Becomes a Liability

A property portal in Bangalore collects 500 buyer inquiries every month. Each inquiry includes name, phone, email, and property preferences. The portal stores these profiles for “future marketing” without ever telling buyers that their data would be retained indefinitely or used to send unsolicited property updates. In June 2026, a buyer files a complaint with the Data Protection Board citing Section 4 violation—not because data was collected, but because notice was missing at the point of collection. The Board issues an order against the portal to stop collection until notice procedures are in place, and penalty proceedings begin. Section 4 compliance is not optional; it is the foundation of lawful data handling under DPDPA.

What Section 4 Actually Requires: Notice, Not Consent

Section 4 of the Digital Personal Data Protection Act mandates that data fiduciaries (property portals, agents, brokers, builders) provide transparent notice before or at the time of collecting personal data. The statute does not forbid data collection—it requires disclosure.

Section 4 states: “No data fiduciary shall collect personal data unless they provide notice to the data principal that personal data is being collected, the purposes for which it is being collected, and such other information as may be prescribed.”

For real estate businesses, Section 4 applies the moment a buyer, seller, tenant, or site visitor provides:

• Name, phone number, email address
• Property preferences, budget range, or investment timeline
• Payment details, bank account, or financial documents
• Identity proof (Aadhaar, PAN, Passport, driver’s license)
• Site visit history or property viewing records
• Family composition or occupancy needs

The notice requirement is separate from consent (Section 6). A buyer may provide their phone number knowing exactly how it will be used—that satisfies Section 4. Whether they actively approve that use is a Section 6 question. Section 4 is the baseline: they must know data is being collected, what is collected, and why.

Why Real Estate Has a Section 4 Compliance Crisis

Real estate generates massive personal data collection without explicit notice systems. A single property listing attracts dozens of inquiries; a brokerage holds thousands of buyer/seller profiles accumulated over years. Section 4 violations occur when:

1. Silent retention — A property portal stores buyer data without notifying inquirers that details are retained for future re-marketing or forwarded to agents.
2. Incomplete notice at signup — An inquiry form says “Submit to schedule a visit” but does not state which data is collected (name? phone? email? budget?) or why each field is needed.
3. Post-collection notice — A buyer enters their phone number, then receives an email hours later saying, “We’ve stored your data.” Too late—notice must come before or at the moment of collection.
4. Vague purpose statements — Phrases like “to improve our service” or “for business purposes” do not meet Section 4’s specificity requirement.
5. Third-party forwarding without notice — An agent forwards a buyer’s inquiry to 10 developers without notifying the buyer that their name and phone are being shared.

The Data Protection Board, enforcing since May 2026, has flagged real estate as high-risk. One data principal complaint + Board investigation = formal Section 4 violation order. Penalty: up to ₹150 crore.

Section 4 Compliance for Real Estate: Step-by-Step Framework

Step 1: Map All Data Collection Points

List every place personal data enters your system. Real estate businesses typically collect at:

• Property inquiry form (online or mobile app)
• Site visit scheduling (phone, WhatsApp, email)
• Agent conversations (verbal data over phone or in-person)
• Lead generation platforms (3rd-party sites forwarding inquiries)
• Document submission (buyer uploading PAN, Aadhaar, salary slip)
• Post-purchase follow-up (surveys, feedback forms, upsell campaigns)

For each point, identify:

• What data is collected (name, phone, email, budget, etc.)
• Why it’s collected (appointment scheduling, property matching, GST verification, etc.)
• Who collects it (your agent, portal backend, third-party tool)

Step 2: Draft Section 4 Notices for Each Collection Point

The notice must be clear, simple, and visible before data entry.

Example 1: Online Property Inquiry Form

Before the inquiry form loads, display this notice:

NOTICE ON COLLECTION OF PERSONAL DATA

We are collecting the following information to help you find 
the right property and schedule site visits:
- Your full name
- Phone number
- Email address
- Property preferences (location, budget, property type)

We will use this information to:
1. Send you appointment confirmations and property details
2. Match you with properties that fit your criteria
3. Comply with tax and regulatory requirements

Your data is stored for 2 years from your last inquiry, 
unless you request earlier deletion.

By proceeding, you acknowledge receiving this notice.

Why this works: It specifies exactly what is collected, lists the purposes clearly, and states retention period. It avoids vague phrases like “service improvement.”

Example 2: Property Agent Phone Collection

When an agent collects data by phone, they must read or share a notice:

"I'm collecting your name, phone number, and property 
interest to schedule your site visit and send you 
matching properties. We keep this data for 2 years. 
You can ask to see, update, or delete your data anytime 
by emailing us. Do you agree to proceed?"

Document that the notice was shared (log timestamp in CRM, send confirmation email/SMS to buyer).

Example 3: Builders Collecting Data at Site Visits

Signage at property site entrances + digital notice before entry:

PERSONAL DATA COLLECTED AT THIS SITE

We collect visitor names, phone numbers, and photography 
for:
- Site visit verification and safety
- Regulatory filing (occupancy compliance)
- Property updates and project information

Data is retained for the project duration plus 1 year.

[QR code linking to full privacy notice]

Step 3: Display Notices Pre-Collection, Not Post-Collection

This is critical. Section 4 requires notice before or at the time of collection. Common mistakes:

❌ Wrong: Buyer fills out form, clicks submit, then sees notice on confirmation page.
✓ Correct: Notice appears before the form; buyer sees notice, reads it, then enters data.

❌ Wrong: WhatsApp message to buyer: “We’ve stored your number for future property updates.”
✓ Correct: Buyer calls agent; agent says, “I’m noting your number to send you matching properties. Okay?” (or sends an SMS with notice before retention).

❌ Wrong: Portal privacy policy (10 pages long) mentions data collection in section 5.
✓ Correct: Each data field on the inquiry form has a short label: “Phone number (used to schedule your visit)“

Step 4: Ensure Notices Are Specific, Not Vague

Section 4 requires specificity in stating which data and which purposes.

Vague Notice	Section 4 Compliant Notice
”We collect personal data to serve you better."	"We collect your name, email, and property budget to match you with properties in your price range."
"Data is stored for business purposes."	"We store your contact details for 2 years to send property updates and confirm appointments."
"We may share data with partners."	"We forward your name and phone to property agents and project developers you’ve shown interest in."
"Retention period: as needed."	"We retain your data for 2 years after your last inquiry, or until you request deletion.”

Step 5: Disclose Third-Party Forwarding

If you sell or forward buyer data to agents, developers, or lead buyers, the original notice must state this.

Example notice on inquiry form:

Who sees your data?
✓ Our agents will contact you about matching properties
✓ Project developers and real estate brokers may receive 
  your contact details to offer properties in your budget
  (unless you opt out below)
☐ I prefer not to be contacted by third-party developers

Step 6: Create a Data Retention Schedule

Section 4 requires stating how long data is kept. Examples:

• Buyer inquiries: Retain for 2 years from last interaction, then delete
• Completed transactions: Retain for 5 years for GST/compliance, then delete
• Tenant screening data: Retain for lease duration plus 1 year
• Site visitor logs: Retain for 6 months, then anonymize

Document this schedule in your Privacy Policy and CRM settings. Implement automatic deletion or review triggers.

Step 7: Audit Compliance Annually

Conduct an annual review of all data collection processes:

1. Screenshot each collection point (form, app screen, phone script).
2. Verify notice appears before data entry.
3. Confirm notice includes: what is collected, why, retention period.
4. Check that notices are simple (no 10-page policies required before entry).
5. Update notices if you add new purposes (e.g., new email newsletter).

Common Section 4 Mistakes in Real Estate

Mistake	Violation?	Fix
Buyer enters phone on inquiry form; no notice visible	YES	Display notice above or within the phone field: “We’ll use your number to confirm site visits and send matching properties.”
Portal stores Aadhaar for “verification purposes” without explaining which verification	YES	Clarify in notice: “Aadhaar verifies your identity for GST registration and legal documentation.”
Retention period in privacy policy says “indefinite” but Section 4 notice says “2 years”	YES	Make both consistent; choose one retention rule and state it uniformly.
Agent collects data verbally on a call with no follow-up documentation	High risk	Send an SMS or email after the call confirming the notice was given: “We discussed storing your name and phone to schedule visits. Please confirm.”
Forwarding buyer data to developers without mentioning third-party sharing in the original notice	YES	Update your notice to state: “We share your contact with real estate developers. Opt out if you prefer.”
Inquiry form says “required fields” but doesn’t explain why each field is required	Borderline – ambiguous	Add brief labels: “Phone (required for site visit confirmation)“
Collecting data on paper forms at site visits with no notice	YES	Use a sign at entry + a notice on the paper form: “This form collects your name, phone, and property interest. See attached privacy notice.”

Real Estate Scenarios: Section 4 in Action

Scenario 1: Online Portal (Compliant)

A buyer visits a property listing website. Before entering an inquiry form, a notice appears:

“We collect your name, email, phone, and property preferences to send you property matches and appointment confirmations. Your data is stored for 2 years. [View full privacy details]”

The buyer reads this, enters their details. ✓ Section 4 compliant. Notice provided before collection; specific about data and purpose.

Scenario 2: Field Agent (Violation)

A real estate agent meets a potential buyer at a construction site. The agent asks for the buyer’s name, phone, and Aadhaar, saying, “Just for verification, it’s standard practice.” No notice is given. Later, the agent’s brokerage sends the buyer unsolicited property listings from 20 other projects. The buyer complains to the Data Protection Board. ✗ Section 4 violation. Data principal was not notified that contact info would be retained for future marketing.

Scenario 3: Tenant Screening (Compliant)

A property manager creates a tenant screening form. Before tenants submit, the form displays:

“We collect identity proof, CIBIL score, and employment details to verify your eligibility to rent this property and comply with landlord-tenant compliance laws. Data is stored for the lease duration plus 1 year, then deleted. [See privacy policy]”

Tenants submit forms with informed awareness. ✓ Section 4 compliant. Notice explains why each data category is needed.

Scenario 4: Lead Forwarding (Violation)

A property lead platform collects buyer inquiries and silently sells the list to 50 real estate brokers, saying “buyer leads are our business model.” No buyer ever saw a notice stating their data would be forwarded and used by third parties. Buyers receive calls from 10 different agents about the same property. One buyer files a Section 4 complaint. ✗ Section 4 violation. Notice did not disclose third-party forwarding.

Section 4 vs. Section 6: Key Difference

Confusion often arises between Section 4 (Notice) and Section 6 (Consent). Here’s the distinction in real estate:

• Section 4 requires notice — telling the buyer what data is being collected and why, before collection.
• Section 6 requires consent — the buyer must affirmatively agree (checkbox, signature, verbal yes) that collection can proceed.

Real estate often involves Section 4 but not always Section 6:

• Collecting a buyer’s phone to schedule a site visit requires Section 4 notice only. (It’s reasonable for the buyer to provide their phone for an appointment they requested.)
• Collecting a buyer’s Aadhaar to verify identity for loan documentation requires Section 4 notice. (The buyer understands why you’re asking.)
• Storing buyer data for unsolicited marketing 2 years later requires both Section 4 notice (upfront: “We may send you future listings”) and Section 6 consent (buyers actively agree to receive marketing).

Notice Template: Copy and Adapt for Your Business

NOTICE ON COLLECTION OF PERSONAL DATA
(Digital Personal Data Protection Act, 2023 — Section 4)

WHAT WE COLLECT
☐ Name, phone number, email address
☐ Property preferences (location, budget, property type)
☐ Financial information (income, savings, loan eligibility)
☐ Identity proof (Aadhaar, PAN, driver's license)
☐ Site visit history and viewing records

WHY WE COLLECT IT
1. Schedule and confirm property site visits
2. Match you with properties fitting your preferences
3. Send property updates and market information
4. Verify identity for GST and legal documentation
5. Comply with regulatory and tax requirements

WHO SEES YOUR DATA
- Our internal team and agents
- Real estate developers and brokers (if you've expressed interest)
- Third-party service providers (CRM, payment processors)

HOW LONG WE KEEP IT
- 2 years from your last inquiry, then we delete it
- Longer if required by law (e.g., GST records: 5 years)

YOUR RIGHTS
- Request access to your data
- Request corrections to inaccurate information
- Request deletion of your data
- Lodge a grievance if you believe we've violated your rights

HOW TO EXERCISE THESE RIGHTS
Email: [privacy@company.com]
Phone: [grievance number]
Portal: [privacy dashboard link if applicable]

By proceeding, you acknowledge receipt of this notice.

---

Enforcement and Penalties

The Data Protection Board of India enforces Section 4 compliance. Real estate firms found in breach of Section 4 notice requirements face:

• First violation (low severity) — Board issues a cease-collection order + mandates compliance audit within 30 days.
• Repeated violation or systemic breach — Up to ₹150 crore penalty per violation.

“Per violation” typically means per data principal affected, so storing 1,000 buyer phone numbers without proper notice could be cited as 1,000 separate violations across multiple enforcement actions. A single investigation into a major portal or brokerage can approach the ₹150 crore ceiling.

What triggers Board enforcement:

• Data principal files a formal complaint (“I was never told my data would be stored”)
• Data Protection Board proactive audit (common for high-traffic platforms)
• Third-party report (consumer forum, regulatory agency)
• Whistleblower complaint from an employee

---

Frequently Asked Questions

Q: Do I need to get written consent from every buyer before collecting their name and phone?

A: No. Section 4 requires notice, not necessarily written consent. A visible notice on your inquiry form before the data field satisfies Section 4. However, if you plan to use data for purposes beyond what the notice covers—such as selling contact lists to third parties or launching a marketing campaign—you’ll also need Section 6 consent (active agreement). For basic site visit scheduling, Section 4 notice alone is often sufficient. For marketing uses, add a checkbox: “I consent to receive property updates and market reports” (Section 6).

Q: I’ve been collecting buyer data for 5 years without formal Section 4 notices. Am I liable?

A: Section 4 became enforceable on July 21, 2023. Data collected before July 21, 2023 is generally not subject to retrospective DPDPA penalties. However, if you are still retaining pre-2023 buyer data without notice, and a buyer complains in 2026, you should retroactively provide notice or delete the data. All future collections must comply with Section 4 immediately. Going forward (July 2023 onwards), every new inquiry must come with Section 4 notice.

Q: A buyer called our office and verbally shared their phone number. Do I need written notice?

A: Section 4 does not specify written notice; the statute says notice must be “provided,” which can include verbal notice. However, to prove compliance if the Board investigates, you should document it. Send an email or SMS to the buyer within a few hours restating the notice: “We discussed storing your phone number to confirm your site visit appointment. You have the right to request deletion anytime by emailing us.” Log this in your CRM with a timestamp. Verbal-only notice with no documentation creates a compliance liability if the buyer later claims they were never notified.

Q: Can I use a single generic notice for all properties, or do I need property-specific notices?

A: A single notice can cover standard collection (name, phone, email for site visits) across all properties. However, if collection purposes vary significantly—for example, luxury residential projects require investment profile data, while commercial real estate requires GST registration details—customize the notice to match the actual data collected for that property type. A one-size-fits-all notice that doesn’t match reality may be deemed too vague to satisfy Section 4.

Q: If I state in my notice that data is retained for “2 years,” am I legally required to delete it automatically after 2 years?

A: Section 4 requires stating the retention period; Section 10 gives data principals the right to request deletion anytime. If your notice says “2 years,” you’ve made a commitment. You should implement a policy to auto-delete, anonymize, or flag data for review after 2 years. If a buyer requests deletion before the 2-year mark and you refuse because “2 years is our policy,” you may violate Section 10. Deletion on request is a separate right from the stated retention period.

Q: We forward buyer inquiries to multiple developers and agents. Do I need to notify buyers about this third-party sharing upfront?

A: Yes. If your notice does not mention third-party forwarding, buyers believe their data is stored only by you. When they discover their number is being called by 10 different agents, they may file a Section 4 complaint (misleading notice about recipients). Update your notice to state: “We share your contact details with real estate developers and agents you’ve shown interest in.” Include an opt-out option: “I prefer not to be contacted by third-party developers.”

---

Real Estate Section 4 compliance is straightforward: provide clear, specific notice before data entry; explain what is collected and why; state retention period; and ensure buyers understand who sees their data. The cost of compliance—a few lines on an inquiry form—is trivial compared to the ₹150 crore penalty for systematic non-compliance. Portals and brokers implementing Section 4 notices report zero Board complaints within 6 months and see improved buyer trust.

DPDPAReady’s compliance team audits real estate data flows and produces a Section 4 notice audit covering every touchpoint (web forms, mobile apps, agent scripts, site visit sign-ins). Contact us for a compliance health check.